Backend and infrastructure work in TypeScript, Python and Go. I spend most of my open-source time on the unglamorous parts of self-hosted tooling: request routing, credential handling, auth boundaries, and the code paths that only run when something has already gone wrong.

vuejs/core

• #15469: readonly(reactive(arr)) handed out writable elements through concat, toReversed, toSorted and toSpliced, so writes reached the raw objects without any warning.

n8n-io/n8n

• #37973: the node scaffolder ran the generated GitHub Actions workflows through Handlebars, which erased ${{ secrets.NPM_TOKEN }} from every new node package.

traefik/traefik

• #13860: on Windows, creating the ACME storage file left its handle open, which blocks renaming or deleting it.

diegosouzapw/OmniRoute: 11 fixes, including:

• #13322: contexts export --no-secrets still wrote every access token and API key, because the negated CLI flags were read under the wrong name.
• #13323: switching private provider URLs off in the dashboard did not override the environment opt-in, so the outbound URL guard stayed disabled.
• #13334: tool results from Gemini clients that send no ids were paired with the wrong call and replaced by an empty string.
• #13321: Anthropic's RFC 3339 rate-limit reset headers were parsed as the number 2026.

nicolargo/glances: 5 fixes

• #3731, #3729, #3730: configuration values that were read with the wrong type or overridden in the wrong order.
• #3728: the process focus filter was appended to on every assignment instead of replaced.
• #3732: a disabled connections probe was forgotten on the next refresh.

can1357/oh-my-pi

• #11480: developer messages and images in user content were counted as zero tokens.
• #11658: forcing a specific tool failed for every OpenRouter model.

All merged pull requests

I try to send patches that a maintainer can verify without trusting me:

• Prove the bug is reachable, not just present. A helper that misbehaves in isolation is a curiosity; a helper that misbehaves on a value the production path actually hands it is a bug. I trace it end to end before writing a fix.
• Every fix comes with a test that fails without it. I revert the patch and re-run to confirm the test actually pins the behaviour, including a test that goes through the real call site, not only the helper in isolation.
• Report what I ran, including what I could not run. If a suite is red before my change, I say which tests and why, by name.
• Say what I rejected. Fixes I tried and dropped usually explain the shape of the one I kept.

Credential redaction and log hygiene · auth and owner-scope boundaries · HTTP/SSE protocol translation between LLM providers · regression tests for bugs that only appear under retry or concurrency.